CVE-2017-9040: Null Pointer Dereference
GNU Binutils 2017-04-03 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash), related to the processmipsspecific function in readelf.c, via a crafted ELF file that triggers a large memory-allocation attempt.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this security issue?
The vulnerability ID for this security issue is CVE-2017-9040.
What is the severity of CVE-2017-9040?
The severity of CVE-2017-9040 is a denial of service (DoS) vulnerability.
Which software is affected by CVE-2017-9040?
GNU Binutils versions 2.26.1-1ubuntu1~16.04.8 and later, 2.29-1, 2.31.1-16, 2.35.2-2, 2.40-2, and 2.41-5 are affected by CVE-2017-9040.
How can a remote attacker exploit CVE-2017-9040?
A remote attacker can exploit CVE-2017-9040 by sending a crafted ELF file that triggers a large memory-allocation attempt, causing a NULL pointer dereference and application crash.
How can I fix CVE-2017-9040?
To fix CVE-2017-9040, you should update your GNU Binutils installation to a version that includes the provided security patches.